Heap Buffer Overflow Vulnerability in HDF5 Package
Summary
DEBIAN-CVE-2024-29160: HDF5 through 1.14.3 contains a heap buffer overflow in H5HG__cache_heap_deserialize, resulting in the corruption of the instruction pointer and causing denial of service or potential code execution. Affects hdf5 versions < 1.14.5+repack-1. Fixed in 1.14.5+repack-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
HDF5 is a widely used file format and set of tools for managing complex data. It is designed to store and organize large amounts of data, providing high performance and flexibility. HDF5 is utilized in various fields, including scientific computing, engineering, and data analysis. However, versions prior to 1.14.5 are susceptible to a critical vulnerability that can lead to severe security issues.
Vulnerability Detail
The vulnerability identified as CVE-2024-29160 is a heap buffer overflow found in the H5HG__cache_heap_deserialize function of the HDF5 library, affecting versions up to 1.14.3. This flaw can corrupt the instruction pointer, potentially leading to denial of service or arbitrary code execution. Attackers exploiting this vulnerability could manipulate the application’s behavior, resulting in unauthorized access or data corruption.
How To Fix
Minimum fixed version
1.14.5+repack-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade hdf5Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds available to mitigate this vulnerability without applying the patch. It is strongly recommended to update to the latest version as soon as possible.
Conclusion
The HDF5 library has a critical vulnerability that can lead to severe security risks if not addressed. Users are urged to update to the latest version to protect their applications from potential exploits. Utilizing tools like Vulert can help monitor for such vulnerabilities in real-time.
See every vulnerability recorded for hdf5 →
FAQ
CVE-2024-29160 is a vulnerability in the HDF5 library that can lead to a heap buffer overflow, potentially allowing attackers to execute arbitrary code.
Versions of HDF5 prior to 1.14.5 are affected by this vulnerability.
You can use Vulert, which monitors and alerts for open-source vulnerabilities. Simply upload your manifest file, such as package-lock.json, to check for vulnerabilities.
Exploiting this vulnerability can lead to denial of service or unauthorized code execution, compromising the security and integrity of the affected application.
Currently, there are no effective workarounds available. The best course of action is to update to the patched version as soon as possible.
References
Related vulnerabilities
Recent vulnerabilities recorded for hdf5.
